Belarusian security services have been using a previously unknown spyware tool to monitor journalists and media workers in what press freedom advocates describe as a major escalation in the repression of independent reporting in the country.
The spyware, which targets Android smartphones and allows access to highly sensitive personal and professional data, was uncovered by Reporters Without Borders’ (RSF) Digital Security Lab (DSL) in cooperation with the Eastern European organization RESIDENT.NGO.
Spyware exposed after journalist interrogation
According to RSF, the tool – initially identified under the name “ResidentBat” – was discovered on the phone of a journalist who had been summoned for questioning by Belarus’ State Security Committee, still known by its Soviet-era name, the KGB.
Before the interrogation at KGB premises, the individual was asked to place the smartphone in a locker, RSF reported. During questioning, the journalist was told to show content on the device and unlocked the phone in an officer’s presence. Afterwards, the device was placed in the locker again. RSF and the journalist believe security officers observed the PIN code and installed the spyware while it was out of the owner’s possession.
Days later, antivirus software detected suspicious components on the device, prompting the journalist to contact RESIDENT.NGO. A joint forensic analysis with RSF’s DSL confirmed the presence of the spyware.
RSF verified the journalist’s identity but withheld it from publication for security reasons.
What the spyware can access
Unlike more widely known spyware tools such as Pegasus, ResidentBat does not rely on exploiting software vulnerabilities or zero-day flaws. Instead, it requires physical access to the target device.
Once installed, the spyware allows operators to access call logs, SMS messages, microphone recordings, screenshots, locally stored files and communications from encrypted messaging applications. RSF said the breadth of access effectively exposes both the private lives and professional networks of targeted journalists.
RSF said it has shared its findings with Google. The tech giant plans to issue “government-backed attack” warnings to Android users identified as potential targets of the spyware campaign.
The origin of the spyware remains unclear. Analysts noted that parts of the code contain English-language strings, suggesting it may not have been developed exclusively for Belarus or could involve third-party developers.
“Deliberate strategy of repression”
RSF described the use of ResidentBat as part of a systematic effort to intimidate and silence independent journalists in Belarus.
“By deploying surveillance technologies such as ResidentBat, the Belarusian state is pursuing a deliberate strategy of repression against independent journalism,” said Antoine Bernard, RSF’s director of advocacy and assistance.
“These tools have nothing to do with national security as alleged by press freedom predator Lukashenko. Instead, they are about intimidation and silencing journalists,” Bernard said, calling for an international ban on invasive surveillance technologies and effective prosecution of crimes committed against journalists.
Press freedom under sustained pressure
Independent media in Belarus has been under severe pressure since the mass protests that followed the disputed 2020 presidential election. Journalists face censorship, intimidation, violence and arbitrary detention, while many media outlets have been shut down or forced into exile.
RSF said 32 journalists are currently imprisoned in Belarus, with reports of torture and ill-treatment increasing. Many journalists now work from abroad, while those remaining inside the country often report anonymously to reduce the risk of retaliation.
Belarus ranks 166th out of 180 countries and territories in the 2025 RSF World Press Freedom Index, underscoring what RSF describes as a climate of systematic repression in which digital surveillance has become a central tool of state control.